CVE-2010-3868

2010-11-1716:00:01

CWE-287

[email protected]

web.nvd.nist.gov

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

AI Score

6.8

Confidence

Low

EPSS

0.006

Percentile

78.6%

JSON

Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System do not require authentication for requests to decrypt SCEP one-time PINs, which allows remote attackers to obtain PINs by sniffing the network for SCEP requests and then sending decryption requests to the Certificate Authority component.

Affected configurations

Nvd

Node

redhatcertificate_systemMatch7.3

redhatcertificate_systemMatch8

Node

redhatdogtag_certificate_system

VendorProductVersionCPE
redhatcertificate_system7.3cpe:2.3:a:redhat:certificate_system:7.3:*:*:*:*:*:*:*
redhatcertificate_system8cpe:2.3:a:redhat:certificate_system:8:*:*:*:*:*:*:*
redhatdogtag_certificate_system*cpe:2.3:a:redhat:dogtag_certificate_system:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	certificate_system	7.3	cpe:2.3:a:redhat:certificate_system:7.3:::::::*
redhat	certificate_system	8	cpe:2.3:a:redhat:certificate_system:8:::::::*
redhat	dogtag_certificate_system	*	cpe:2.3:a:redhat:dogtag_certificate_system::::::::